krekan-login-en-us[.]framer[.]media

The domain krekan-login-en-us.framer.media was registered on 21 February 2026 through CSC Corporate Domains, Inc. and resolves to the Amazon‑owned address 52.223.52.2 (AS16509). The hosting provider is Amazon Web Services, a common infrastructure for both legitimate services and malicious campaigns. The site presented a valid TLS certificate issued by Let’s Encrypt (certificate identifier E7) and the server advertised HSTS and HTTP/3, indicating a modern web stack. Front‑end fingerprints show the use of Framer Sites and React, which are frequently employed in rapid‑deployment phishing kits.

Google Safe Browsing has classified the domain as a social‑engineering threat, and VirusTotal’s aggregation shows nine out of ninety‑three scanners flagging the host, confirming the presence of malicious indicators. The page title “Kraken Pro Login | Access Your Crypto Trading™ Account” explicitly references the cryptocurrency exchange Kraken, and the intelligence file lists the scam type as a crypto‑scam that impersonates Kraken. The domain is currently offline, returning HTTP 404, and has been added to multiple blocklists, including PhishDestroy, MetaMask, and SEAL; three independent security blocklists also list the host. Defenders should note that the domain’s infrastructure—AWS IP space, Let’s Encrypt TLS, and the Framer/React stack—matches patterns observed in other credential‑harvesting campaigns targeting cryptocurrency users.

Email filtering and web‑proxy policies that reference the known bad host, the associated page title, and the Safe Browsing classification can be used to block future requests. Because the site is already taken down, the immediate risk is limited to any credentials harvested before the takedown; however, the reuse of the same hosting and certificate profile in future campaigns is plausible. Continuous monitoring of newly‑registered domains that resolve to the same AWS CIDR block and that present similar Kraken‑related titles is recommended.